CVE-2021-32792

mod_auth_openidc: XSS when using OIDCPreservePost On

Loading…

Severity

Moderate

Red Hat Product Security

6.1

CVSS 3.1

Review impact separately from score.

Published · July 24, 2021

Updated · November 22, 2025

Description

A flaw was found in mod_auth_openidc. When mod_auth_openidc is configured with OIDCPreservePost On it is possible to trigger a cross site scripting(XSS) vulnerability that could be used by a remote attacker to execute code on the browser of the victim user. The highest threat from this flaw is to data confidentiality and integrity.

Statement

This issue did not affect the versions of mod_auth_openidc as shipped with Red Hat Enterprise Linux 7 as they did not include support for OIDCPreservePost option.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 3.1 · 6.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')